14
votes
5answers
1k views

Is a VM only as secure as its host?

Question If one installs a VM with "high security" on a host machine with "low security", will the VM be only as secure as the machine it's installed on, or will the high-security aspects from the VM ...
6
votes
2answers
6k views

How can I prevent people from duplicating my barcodes [duplicate]

I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates. I would like to offer a discount card that has a ...
7
votes
5answers
676 views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
2
votes
2answers
674 views

7zip AES encrypted archive, padding oracle attack

I created an encrypted but forgot the password. When I attempted a pattern based brute force it said it had over a 100 trillion passwords to check. And to my knowledge that could take a few years. ...
5
votes
1answer
402 views

Is it safe to abandon a free webmail account that has been in use for a significant amount of time?

I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address. I have concerns around accounts that I may have ...
-2
votes
2answers
870 views

Evaluating candidates for Hacker/Pen Test Positions [closed]

If I need to employ Penetration Testers, what are the procedures to follow and how to examine candidates to know their skills and qualifications. Also, I need to know what are the ...
-1
votes
1answer
650 views

Is it still possible to sign up for a Google account without SMS verification? (March, 2013) [closed]

Non of these two methods worked: http://googlesystem.blogspot.com/2012/01/new-google-accounts-require-gmail-and.html
3
votes
3answers
706 views

Stop code injections into page code

I started a topic HERE on the stackoverflow site, but was refered here. I did get some info there, but think it need's more indepth input. So hopefuly people here can help. I have a few domains ...
3
votes
1answer
5k views

Certificate Chains When Importing Signed CSR Response

I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration: Generate a private key into keystore Generate a CSR ...
-3
votes
1answer
375 views

OTR encrypted chatroom or IM [closed]

I need a secure, encrypted environment for conducting text based interviews online. It's for academic research purposes where data protection is paramount so there cant be any data stored on 3rd ...
9
votes
5answers
654 views

How would you detect whether customer data has been leaked?

I'm a very security conscious (bordering paranoia) freelance web developer and I place a lot of emphasis on security with my clients, alas I've found this doesn't seem to be the case for the average ...
5
votes
3answers
4k views

Could I delete .csr files once the key was signed by CA

I'm creating my own openvpn server. The Certificate authority is located on a separated host. There is two kind of clients: which that just send a .csr and to which i send the .crt as an answer and ...
7
votes
3answers
4k views

For how much time should I randomly move the mouse for generating encryption keys?

When creating a Truecrypt volume, there is the wizard page in which the user is told to randomly move the mouse (the longer the better) to generate entropy, and that it will significantly increase the ...
2
votes
1answer
187 views

Mutual Anonymity in key exchange

If Alice (sender) sends a private message embedded with public key of the Bob(recipient) through onion network, so in this key exchange, does Bob remains anonymous to Alice as Alice knows about the ...
2
votes
2answers
147 views

Database security: Remove superuser role

I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles. I imagine that ...
26
votes
2answers
17k views

Risks of a php image upload form

So I have a client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated ...
2
votes
1answer
140 views

Where can I find articles about identity disclosure attack?

Where can I find more details about identity disclosure attack and it's prevention? If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
2
votes
2answers
433 views

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
2
votes
0answers
425 views

What is SPL exploit? [closed]

I recently worked on a web project that uses Javascript and PHP to load its content from flickr API. I kept on getting this image show up and disappear immediately during first 2 or 3 seconds of the ...
0
votes
0answers
29 views

CRIME attack clarrification [duplicate]

I am not understanding CRIME attack completealy.. First an attacker runs a script to caputure the encrypted cookies later using the captured value an attacker try to bruteforce the next cookie ...
1
vote
1answer
959 views

Script injection on different hosting servers = FTP hacking?

I've been seeing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
4
votes
3answers
2k views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
24
votes
4answers
34k views

Why don't major browsers currently support TLS above version 1.0?

TLS 1.0 seem to be vulnerable to Beast, Lucky13 and maybe other attacks and is simply outdated. Common workaround used e.g. by Google was to use RC4 which was also recently broken, but none of the ...
26
votes
2answers
20k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
8
votes
1answer
877 views

Device fingerprinting & Mass Computer Surveillance

Device fingerprinting is one of the biggest privacy problems as explained because people think cleaning cookies, using proxy servers or blocking domains can protect them (when blacklisted trackers ...
0
votes
1answer
604 views

Automating tests for XSS in bash?

The book:"Web Security Testing Cookbook By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
0
votes
2answers
438 views

Recover password or password hash from locked account

I have a locked administrator account. Other accounts are unlocked, but they have no rights. I want to get a password from the locked account, or maybe password hash, if possible.
1
vote
2answers
2k views

Two-way SSL Performance

We are planning to use 2 way ssl instead of username/password token for authentication. Does anyone know what is the performance penalty for using 2 way SSL?
4
votes
2answers
477 views

Where to draw the line with password managers? [duplicate]

I have just started using a password manager and was wondering what is the best practice regarding where to draw the line regarding what is stored in the software. Ideally I could store Windows/Unix ...
6
votes
1answer
10k views

Exchange of DEK and KEK (encryption keys) between app server and key server

In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
4
votes
4answers
274 views

Anonymized Votes

Background Looking to create an anonymous voting system. The system must track whether or not a user voted on an item (public information), but only that user is ever allowed to know whether they ...
81
votes
8answers
16k views

How would one crack a weak but unknown encryption protocol?

I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
6
votes
5answers
3k views

How can I portscan large subnets?

I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, ...
17
votes
4answers
60k views

Converting keys between openssl and openssh

If I use the following openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes I get private.pem and public.pem If I use ssh-keygen -t rsa -f rsa I get rsa and ...
5
votes
1answer
185 views

GPG warns about unprotected subkeys while using monkeysphere

Issuing monkeysphere subkey-to-shh-agent GPG warns me: gpg: about to export an unprotected subkey then it asks for the passphrase and everything works fine. What's the meaning of "export an ...
4
votes
3answers
5k views

Storing anti-CSRF token in cookie

I generate a random anti-CSRF token per session and store it in a cookie (with the http_only flag set). Then I add that token to forms (in a hidden input field) and links. When receiving a request on ...
2
votes
1answer
584 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
4
votes
3answers
157 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
3
votes
1answer
498 views

Can a user's Apple Keychain be opened on a different computer?

Apple uses a nice keychain. This is used by, for example, Google's Chrome browser. Imagine a user copies all the keychain files. Would that user be able to unlock the keychain, if they knew the ...
9
votes
3answers
1k views

Is it safe to sync private keys between iOS devices using iCloud?

My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
-1
votes
2answers
411 views

Hiding emails from Google [closed]

From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons. If a have a group of people who want to hide their emails from Google, how ...
-3
votes
2answers
2k views

Is pixel based image encryption secure?

I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
14
votes
2answers
542 views

Concrete figures on password cracking in the wild

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs. It's easy enough to test online password guessing ...
-2
votes
2answers
1k views

How to completely password protect login into Ubuntu 12.10?

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite ...
1
vote
2answers
5k views

Proxy / VPN Quality Check / Detection

Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software? I have already tried to use this code, but it doesn't detect all proxies, in fact it detect ...
0
votes
3answers
661 views

If a “man in the middle attack” obtains the username & password of user, are there mechanisms that can prevent them connecting to server?

Assume that we have a user that wants to connect to the server, for example with login page, when user submits the username & password goes to the server - if man in the middle reads the user ...
3
votes
2answers
914 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
2
votes
0answers
297 views

User friendly PGP email [closed]

Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience? Generate new key at first startup, rather than asking the user if they have an ...
4
votes
1answer
867 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...

15 30 50 per page